Q: How can events be reconstructed after an incident?
or
Q: After an occurrence, how can events be reconstructed?
- By replaying security video footage
- By doing analysis of forensic malware
- By reviewing and analyzing logs
- By interviewing the people involved
Explanation: Logs provide a detailed record of activities and system events that can help trace the sequence of actions leading up to and during the incident. While interviews and malware analysis may offer additional insights, log analysis is key to accurately reconstructing events. Replaying security video footage is helpful for physical security incidents but is not typically applicable to digital events.
